The setting is changeLog.consumer.pspng_activedirectory.userSearchFilter = (&(objectclass=person)(cn=${subject.getAttributeValue("loginid")})). When subject is not in cache, we got following error: 2019-09-12 08:33:07,466:t-1 [TSUserFetcher-pspng_activedirectory-full-3] ERROR [pspng_activedirectory-full] QID=8/ExtRef=null/FullSyncer(pspng_activedirectory)/cs.auckland.ac.nz:COMPSCI.210.T.S2.2009.marker/#343664(Existing)/doit/ - - Jexl Expression UserSearchFilter '(&(objectclass=person)(cn=${subject.getAttributeValue("loginid")}))' could not be evaluated for subject ''578524531'/'person'/'jdbc'/null' and group 'null/null' which used variableMap '{userSearchBaseDn=ou=people,dc=uoadev,dc=auckland,dc=ac,dc=nz, provisionerType=UoALdapGroupProvisioner, groupCreationBaseDn=ou=groups,dc=uoadev,dc=auckland,dc=ac,dc=nz, utils=edu.internet2.middleware.grouper.pspng.PspJexlUtils@76b724f5, subject='578524531'/'person'/'jdbc', provisionerName=pspng_activedirectory, groupSearchBaseDn=ou=groups,dc=uoadev,dc=auckland,dc=ac,dc=nz}' java.lang.RuntimeException: Error substituting string: '${subject.getAttributeValue("loginid")}' at edu.internet2.middleware.grouper.util.GrouperUtil.substituteExpressionLanguage(GrouperUtil.java:9483) at edu.internet2.middleware.grouper.pspng.Provisioner.evaluateJexlExpression(Provisioner.java:739) at edu.internet2.middleware.grouper.pspng.LdapProvisioner.getUserLdapFilter(LdapProvisioner.java:272) at edu.internet2.middleware.grouper.pspng.LdapProvisioner.fetchTargetSystemUsers(LdapProvisioner.java:200) at edu.internet2.middleware.grouper.pspng.Provisioner$2.call(Provisioner.java:884) at edu.internet2.middleware.grouper.pspng.Provisioner$2.call(Provisioner.java:878) at java.util.concurrent.FutureTask.run(FutureTask.java:266) at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) at java.lang.Thread.run(Thread.java:748) Caused by: org.apache.commons.jexl2.JexlException: edu.internet2.middleware.grouper.util.GrouperUtil.substituteExpressionLanguage@9428![8,36]: 'subject.getAttributeValue('loginid');' method invocation error at org.apache.commons.jexl2.Interpreter.call(Interpreter.java:1076) at org.apache.commons.jexl2.Interpreter.visit(Interpreter.java:1100) at org.apache.commons.jexl2.parser.ASTMethodNode.jjtAccept(ASTMethodNode.java:18) at org.apache.commons.jexl2.Interpreter.visit(Interpreter.java:1317) at org.apache.commons.jexl2.parser.ASTReference.jjtAccept(ASTReference.java:18) at org.apache.commons.jexl2.Interpreter.interpret(Interpreter.java:232) at org.apache.commons.jexl2.ExpressionImpl.evaluate(ExpressionImpl.java:65) at edu.internet2.middleware.grouper.util.GrouperUtil.substituteExpressionLanguage(GrouperUtil.java:9434) ... 9 more Caused by: java.lang.IllegalStateException: There is no open GrouperSession detected. Make sure to start a grouper session (e.g. GrouperSession.startRootSession() if you want to use a root session ) before calling this method at edu.internet2.middleware.grouper.GrouperSession.staticGrouperSession(GrouperSession.java:1152) at edu.internet2.middleware.grouper.GrouperSession.staticGrouperSession(GrouperSession.java:1100) at edu.internet2.middleware.grouper.subj.SourcesXmlResolver.find(SourcesXmlResolver.java:316) at edu.internet2.middleware.grouper.subj.CachingResolver.find(CachingResolver.java:143) at edu.internet2.middleware.grouper.subj.ValidatingResolver.find(ValidatingResolver.java:105) at edu.internet2.middleware.grouper.SubjectFinder.findByIdAndSource(SubjectFinder.java:505) at edu.internet2.middleware.grouper.subj.LazySubject.getSubject(LazySubject.java:215) at edu.internet2.middleware.grouper.subj.LazySubject.getAttributeValue(LazySubject.java:139) at sun.reflect.GeneratedMethodAccessor500.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at org.apache.commons.jexl2.internal.MethodExecutor.execute(MethodExecutor.java:64) at org.apache.commons.jexl2.internal.AbstractExecutor$Method.invoke(AbstractExecutor.java:327) at org.apache.commons.jexl2.Interpreter.call(Interpreter.java:1068)